A SaaS vendor runs its API on virtual machines behind an internal Standard Load Balancer. Customers in other tenants must reach it over private addressing without any public exposure. What should the vendor create?
Show answer and explanation
Answer: B
A Private Link service is published by the provider on top of a Standard Load Balancer frontend. Each consumer then creates a private endpoint in its own virtual network, and that endpoint receives a private address that connects to the published service. The vendor's API stays internal, and nothing is exposed on a public address.
Why the other options are wrong
- A. Azure Bastion gives administrators secure remote sessions to virtual machines. It does not publish an application to other tenants' networks, so customers still could not reach the API privately.
- C. A public IP on the frontend would make the API reachable from the internet, which violates the requirement that nothing is exposed publicly. Partner networks would also still traverse public paths.
- D. Service endpoints are enabled by consumers on their own subnets and only reach public PaaS endpoints. They cannot publish a vendor-hosted internal load balancer to other tenants.